Recently I asked a question about possibly unwanted calls due to extended
transfer rights after
attended transfers using DTMF sequences 
(http://lists.digium.com/pipermail/asterisk-users/2013-September/280536.html).
Obviously,
transferring with SIP INVITEs (hold + transfer keys) is not immediately affected
by the this,
but it is not always possible to enforce this.
Meanwhile I have changed the dial options in my dial plans in such a way that
they are based on
the origin of the participating channels regardless of the number of transfers
and the local
intermediate contexts.
I think it would be easier to handle the rights with the device configuration
and not at the
switching points in the dialplan. Depending on the origin of the call the caller
or callee or
both should have transfer rights. For a call from outside (e.g. via an ISDN
channel) only the
callee should have transfer rights. For internal calls typically both parties
are allowed to
transfer and for calls to the outside only the caller should have the rights. At
least this is
the setup I typically use. A simple flag "allowtransfer", like for the
old sip channel, should
resolve this. I think it is the devices that matter when creating a bridge and
not the current
context in the dialplan.
This is an example of what is currently happening for an attended transfer when
DTMF sequences
are allowed
Call from outside:
[from-pstn]
exten => _X.,1,Dial(SIP/....,,...t...)    ; fine -- only callee can transfer
Attended transfer (Asterisk uses a Local channel to connect):
[from-internal]
exten => 1234,1,Dial(Local/....,,Tt...)    ; bad -- from here on the outside
caller can do
whatever he wants
in this case it should be
exten => 1234,1,Dial(Local/....,,t...)
Call from inside:
[from-internal]
; e.g.
exten => _X.,1,Dial(DAHDI/r2/${FILTER(0-9,${EXTEN})},,...T...)  ; fine --
only caller can transfer
Atx:
[from-internal]
exten => 1234,1,Dial(Local/....,,Tt...)    ; bad again
in this case it should be
exten => 1234,1,Dial(Local/....,,T...)
If both parties are local then "exten => 1234,1,Dial(....,,Tt...)"
is fine.
I would like to hear comments about this, even if I have overlooked something
that makes me look
stupid.
One last remark. It may not be easy to explore this when using 2 Asterisk
systems as the DTMF
sequences are first caught by the originating system (but the entries in
features.conf can be
deleted).
jg